       (let [access-token (second (re-matches #"\Qtoken\E\s+(.*)" (get (:headers request) "authorization")))
             session (get-session (:access-token-store this) access-token)
             scopes (:scopes session)]
-
         (infof "session is %s, scopes is %s" session scopes)
-
-        (when scopes
-          (scopes scope)))
+        (when scopes (scopes scope)))
 
       ;; Not a valid scope
-
-      (throw (ex-info "Not a valid scope!" {:scope scope}))
-
-      )))
+      (throw (ex-info "Not a valid scope!" {:scope scope})))))
 
 (defn new-oauth2-access-token-authorizer [& {:as opts}]
-  (component/using (->OAuth2AccessTokenAuthorizer) [:access-token-store :auth-server])
-)
+  (component/using (->OAuth2AccessTokenAuthorizer) [:access-token-store :auth-server]))
+
+;; Optional ApplicationRegistry implementation
+
+(defrecord RefBackedApplicationRegistry []
+  component/Lifecycle
+  (start [this]
+    (assoc this :store {:last-client-id (ref 1000)
+                        :applications (ref {})}))
+  (stop [this] this)
+
+  ApplicationRegistry
+  (register-application [this properties]
+    (dosync
+     (let [client-id (or (:client-id properties)
+                         (str (alter (-> this :store :last-client-id) inc)))
+           properties (assoc properties
+                        :client-id client-id
+                        :client-secret (or (:client-secret properties)
+                                           (str (java.util.UUID/randomUUID))))]
+       (alter (-> this :store :applications) assoc client-id properties)
+       (select-keys properties [:client-id :client-secret]))))
+
+  (lookup-application [this client-id]
+    (-> this :store :applications deref (get client-id))))
+
+(defn new-ref-backed-application-registry []
+  (->RefBackedApplicationRegistry))

        map->AuthServer)
   [:access-token-store
    :session-store
    :user-domain]))

;; --------


   [clj-time.core :refer (now plus days)]
   ))

(defprotocol Scopes
  (valid-scope? [_ scope]))

(defprotocol ApplicationRegistry
  (register-application [_ properties])
  (lookup-application [_ client-id]))

(s/defn register-application+ :- {:client-id s/Str
                                  :client-secret s/Str}
  [p :- (s/protocol ApplicationRegistry)
   ;; If client-id and/or client-secret are not specified, they will be
   ;; generated.
   properties :- {(s/optional-key :client-id) s/Str
                  (s/optional-key :client-secret) s/Str
                  :application-name s/Str
                  :homepage-uri s/Str
                  (s/optional-key :description) s/Str
                  :callback-uri s/Str}]
  (register-application p properties))

(s/defn lookup-application+ :- {:application-name s/Str
                                :homepage-uri s/Str
                                (s/optional-key :description) s/Str
                                :callback-uri s/Str
                                :client-id s/Str
                                :client-secret s/Str}
  [p :- (s/protocol ApplicationRegistry)
   client-id :- s/Str]
  (lookup-application p client-id))

;; TODO: client secret
;; TODO: callback uri

(defrecord AuthServer [store scopes iss]
  Scopes
